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ABSTRACT 


AUTHOR:  Colonel  Calvin  D.  Lawyer 

TITLE:  Continuity  Of  Operations  Planning  (COOP):  A  Strategy  For  Implementation 

FORMAT:  Strategy  Research  Project 

DATE:  18  March  2005  PAGES:  29  CLASSIFICATION:  Unclassified 

Federal,  state,  and  local  governments  must  plan  for  continuity  of  operations  in  the  event  of 
a  disaster  or  emergency  by  implementing  Continuity  of  Operations  Planning  (COOP).  COOP  is 
a  critical  part  of  daily  operations  because  if  a  disaster  or  emergency  strikes,  it  will  impact  every 
aspect  of  the  organization;  the  nature  of  the  event  (natural  or  manmade)  will  determine  whether 
that  impact  is  major  or  minor.  A  successful  COOP  plan,  maintains  the  highest  level  of 
readiness,  is  capable  of  implementation  with  or  without  warning,  can  be  operational  within  6  to 
12  hours  after  activation,  has  the  ability  to  sustain  operations  for  up  to  30  days,  takes  advantage 
of  the  existence  of  other  organizations’  infrastructures,  is  exercised  annually  and  has  the 
commitment  from  the  leaders  of  the  organizations.  All  organizations  within  the  Department  of 
Defense  (DOD)  are  dependent  on  people,  communications,  and  a  command  and  control 
infrastructure  to  conduct  daily  operations.  Before  September  1 1 , 2001 ,  COOP  was  not  a  top 
priority  of  organizations  within  the  DOD.  Since  then,  however,  these  organizations  have 
committed  to  developing  a  plan  that  would  allow  the  DOD  to  carry  out  its  essential  functions  in 
the  event  of  an  emergency  or  disaster.  This  paper  will  highlight  the  importance  of  COOP, 
examine  the  challenges  that  DOD  organizations  face  when  developing,  executing,  and 
maintaining  plans  in  the  event  of  a  disaster  and/or  emergency,  and  recommend  a  strategy  of 
implementation.  It  will  also  address  major  areas  of  concerns  that  are  involved  in  the  creation  of 
a  COOP  program. 
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CONTINUITY  OF  OPERATIONS  PLANNING  (COOP):  A  STRATEGY  FOR  IMPLEMENTATION 
BACKGROUND 

From  July  2002  to  July  2004, 1  was  the  Chief  of  the  Continuity  of  Operations  Branch  for 
Headquarters  Department  of  the  Army,  which  gave  me  firsthand  knowledge  of  the  challenges 
and  difficulties  that  an  organization  faces  when  trying  to  develop  a  COOP  plan.  While 
researching  this  project,  I  was  not  surprised  by  the  similarities  between  what  I  discovered  and 
what  I  had  experienced  for  two  years  as  the  Branch  Chief.  I  was  also  reminded  of  concerns 
others  and  I  had  expressed  in  his  past  assignments. 

In  my  twenty-three  years  of  service,  I  have  served  at  various  levels  of  assignments,  from 
platoon  through  staff  assignment  at  Department  of  Defense.  At  all  levels  there  was  concern 
about  being  able  to  relocate,  jump  or  hand  over  operational  control  to  another  location  within  our 
organization.  At  the  tactical  level  they  were  trained  to  relocate  or  hand  over  control  of  the 
command  post  or  Tactical  Operations  Center  (TOC),  while  not  giving  much  attention  to  the 
garrison  location.  The  combination  of  researching  this  project  and  my  last  assignment  has 
caused  me  to  become  passionate  about  the  need  for  a  COOP  program.  I  feel  that  if 
organizations  within  the  DOD  fail  to  develop  and/or  improve  their  COOP  program,  the  oversight 
may  have  an  incomprehensible  impact  that  could  cause  the  American  people  undo  frustration, 
distress,  and  in  some  cases,  death.  This  paper  will  highlight  the  importance  of  Continuity  of 
Operations  Plan  (COOP)  and  examine  the  challenges  that  COOP  planners  face  when 
developing,  implementing,  executing,  and  maintaining  plans  in  case  of  a  disaster.  It  will  also 
recommend  steps  for  DOD  organizations  to  begin  creating  a  COOP  plan  to  ensure  essential 
government  services  are  available  in  the  event  of  emergencies. 

Dear  Mr.  Chairman 

As  you  know  Federal  operations  and  facilities  have  been  disrupted  by  a  range  of 
events,  including  the  terrorist  attacks  on  September  1 1 , 2001 ;  the  Oklahoma  City 
bombing;  localized  shutdowns  due  to  severe  weather  conditions,  such  as  the 
closure  of  federal  offices  in  Denver  for  3  days  in  March  2003  due  to  snow;  and 
building-level  events,  such  as  asbestos  contamination  at  the  Department  of  the 
Interior's  headquarters.  Such  disruptions,  particularly  if  prolonged,  can  lead  to 
interruptions  in  essential  government  services.  Prudent  management,  therefore, 
requires  that  federal  agencies  develop  plans  for  dealing  with  emergency 
situations,  including  maintaining  services,  ensuring  proper  authority  for 
government  actions,  and  protecting  vital  assets.23 

The  terrorist  attack  of  September  1 1 , 2001  caught  the  federal  government  by  surprise. 

The  Department  of  Defense,  along  with  other  federal  agencies,  was  not  fully  prepared  to 
relocate  to  an  alternate  site  and  continue  to  carry  out  its  Title  1 0  Essential  Functions.  Had  the 


attacks  continued  for  some  time,  the  DOD  would  have  been  in  a  position  of  building  an  alternate 
command  and  control  site  from  ground  zero,  with  little  time  or  thought  going  into  the  functions, 
capacities  and  relationships  that  make  a  Continuity  of  Operations  Planning  (COOP)  plan 
function  well.  The  strategic  impact  of  this  lack  of  preparation  would  have  been  indescribable. 

It  is  critical  that  all  organizations  within  the  DOD  appreciate  the  importance  of  developing 
a  good  COOP  program — and  take  seriously  the  consequences  if  they  do  not.  While  most 
understand  COOP,  it  is  not  a  top  priority  and  in  many  cases  it  is  not  resourced  properly  and 
lacks  the  necessary  elements  to  make  it  viable.  COOP  programs  within  the  DOD  should  be 
integrated  into  the  operations  of  all  DOD  organizations  and  exercised  regularly,  and  they  must 
be  provided  with  the  resources  to  make  the  program  physically  and  fundamentally  sound. 
Organizations  that  fail  to  do  this  must  understand  the  impact  this  may  have  on  the  American 
people. 

CONTINUITY  OF  OPERATIONS  PLANNING  (COOP):  A  STRATEGY  FOR 
IMPLEMENTATION 

The  policy  of  the  United  States  government  is  to  have  in  place  a  comprehensive  and 
effective  program  to  ensure  the  continuity  of  essential  federal  functions  under  all  circumstances, 
including  potential  emergencies  and/or  disasters.  COOP  is  simply  a  good  business  practice — 
part  of  the  fundamental  mission  of  agencies  to  be  responsible  and  reliable  public  institutions. 

For  years,  COOP  planning  had  been  an  individual  agency  responsibility,  implemented  primarily 
in  response  to  emergencies  and/or  disasters  within  the  confines  of  the  organization 24  and  the 
content  and  structure  of  COOP  plans,  operational  standards,  and  interagency  coordination  were 
left  to  the  discretion  of  the  agency.  The  changing  threat  environment  and  recent  emergencies 
(including  acts  of  nature,  accidents,  and  terrorist  attacks)  has  shifted  awareness  to  the  need  for 
COOP  capabilities  that  enable  agencies  to  continue  their  essential  functions.  The  potential  for 
terrorist  use  of  weapons  of  mass  destruction  has  also  emphasized  the  need  to  provide  the 
President  with  the  ability  to  ensure  continuity  of  essential  government  functions  across  the 
Federal  and  Executive  Branches. 

The  goal  of  COOP  planning  is  the  development  of  an  assurance  that  capabilities  exist  to 
continue  essential  functions  of  an  organization  across  a  wide  range  of  potential  emergencies. 
These  objectives  include  ensuring  the  continuous  performance  of  essential  functions/operations 
during  an  emergency;  protecting  essential  facilities,  equipment,  records,  and  other  assets; 
reducing  or  mitigating  disruptions  to  operations;  reducing  loss  of  life,  minimizing  damage  and 
losses;  and  achieving  a  timely  and  orderly  recovery  from  an  emergency  and  resumption  of  full 
service  of  operations.  Guidelines  and  directives  have  been  established  for  the  President,  DOD 
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and  other  federal  agencies  that  help  with  the  identification  and  development  of  organization 
objectives  for  COOP  planning.25 

GOVERNING  DIRECTIVES 

Continuity  of  Operations  started  to  gain  national  attention  and  momentum  with  the 
publication  of  the  DOD  Directive  3020.26  dated  May  26, 1 995.  This  directive  mandated  that  all 
DOD  components  must  have  the  capability  to  continue  essential  functions  without  unacceptable 
interruption.  COOP  planning  includes  preparatory  measures,  response  actions,  and  restoration 
activities  to  maintain  effectiveness,  readiness,  and  survivability.26 

On  October  21, 1998  Presidential  Decision  Directive  (PDD)  67,  “Enduring  Constitutional 
Government  and  Continuity  of  Government  Operations,”  was  published.  While  PDD  67  was 
classified,  the  unclassified  version  was  published  in  the  Federal  Preparedness  Circular  (FPC) 
65,  Federal  Emergency  Management  Agency  (FEMA)  dated  July  26, 1 999,  and  again  on  April 
30,  2001 .  The  1 999  documents  mandated  that  all  federal  agencies  have  a  viable  COOP 
capability  in  place,  which  ensures  the  performance  of  their  essential  functions  during  any 
emergency  or  situation  that  may  disrupt  normal  operations27  The  overall  objective  of  FPC  66 
(published  April  30,  2001)  was  the  development  of  a  Training,  Test  and  Exercise  Program 
(TT&E)  to  implement  and  institutionalize  a  comprehensive,  all-hazard  program  to  improve  the 
ability  of  organizations  to  effectively  manage  and  execute  their  COOP  plans. 28  DOD  Directive 
3020.26  updated  September  8,  2004  established  the  Defense  Continuity  Program  (DCP)  and 
the  Defense  Continuity  Executive  Steering  Group  (Continuity  ESG).  The  updated  document 
revised  continuity  policies  and  assigned  responsibilities  for  developing  and  maintaining  the  DCP 
to  enhance  the  DOD  readiness  posture.29  The  entire  list  of  COOP  documentation  helps 
reinforce  the  need  for  federal  organizations  to  develop  a  COOP  plan  to  continue  their  essential 
functions. 

While  the  need  for  COOP  planning  should  be  apparent  to  all  individuals  in  any  DOD 
organization,  this  is  often  not  the  case.  Some  organizations  have  very  good  plans  in  place  and 
exercise  them  in  accordance  with  governing  directives.  However,  other  organizations  have  not 
planned,  and  in  some  cases  COOP  receives  only  “lip  service”  or  becomes  just  a  paper  drill  to 
get  through  the  next  inspection.  Unfortunately,  COOP  often  only  becomes  very  important  to  a 
DOD  organization  after  an  actual  disaster  takes  place,  and  the  failure  is  staring  the  organization 
in  its  face30  COOP  is  difficult  and  expensive  to  implement,  but  the  difficulty  and  expense 
endured  by  the  nation  increases  exponentially  if  a  disaster  occurs  and  there  is  no  plan  in  place. 
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The  taxpayers  believe  DOD  is  working  in  the  best  interest  of  the  American  people,  and  we  must 
never  fail  that  trust. 

A  COOP  plan  should  always  protect  people,  information  and  equipment,  which  is  critical 
to  any  organization.  Understanding  how  the  elements  work  together  to  meet  the  goals  of  an 
organization  is  crucial  to  a  successful  COOP  and  an  annual  assessment  of  needs  and  goals  are 
value-added  in  developing  a  plan.  Realistically,  the  failure  to  assess  and  address  the  risks 
associated  with  a  biological  incident,  civil  unrest,  earthquake,  fire,  hazardous  materials  spill, 
severe  heat  wave,  hurricane,  nuclear  attack,  nuclear  power  plant  incident,  power  outages, 
terrorism,  tornado,  or  severe  winter  storm,  would  have  significant  adverse  impact  on  an 
organization  and  its  people.31 

All  organizations  should  conduct  a  systematic  risk  assessment  annually,  or  as  needed, 
based  on  other  identified  factors.  An  assessment  of  34  COOP  plans  by  the  General  Accounting 
Office  (GAO)  in  2004  found  that  most  agencies  identified  at  least  one  function  as  essential. 
However,  the  number  of  functions  in  each  plan  varied  widely  from  3  to  399,  and  included  some 
that  appeared  to  be  of  secondary  importance  to  carrying  out  daily  operations  while  at  the  same 
time  omitting  programs  that  had  been  previously  defined  as  high-impact.  One  department 
included  a  questioner  to  speeches  and  articles  for  the  Secretary  and  Deputy  Secretary  as  high- 
impact  among  its  essential  functions,  but  did  not  include  9  of  1 0  high-impact  programs  for  which 
it  is  responsible. 

Several  factors  contributed  to  these  shortcomings.  FPC  65  did  not  provide  specific  criteria 
for  identifying  essential  functions.  FEMA  did  not  review  the  essential  functions  identified  when  it 
assessed  COOP  planning,  and  it  did  not  conduct  tests  or  exercises  to  confirm  that  the  essential 
functions  were  correctly  identified.  Unless  agencies'  essential  functions  are  correctly  and 
completely  identified,  their  COOP  plans  may  not  effectively  ensure  that  the  most  vital 
government  services  can  be  maintained  in  an  emergency. 32  Although  all  but  three  of  the 
agencies  reviewed  had  developed  and  documented  some  of  the  elements  of  a  viable  COOP 
plan,  none  of  the  agencies  could  demonstrate  that  they  were  following  all  the  guidelines  in  FPC 
65.  As  the  chart  in  Figure  1  shows,  there  is  a  wide  variation  in  the  number  of  organizations  that 
addressed  various  elements  identified  in  the  guidelines. 
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Elements|That  Were  Included  in  Agency  COOP  Plans  in  Place  as  of  October  1.  2002 

Of  the  34  COOP  plans  reviewed,  how  many  ... 

Identified  agency's  essential 
functions? 

Prioritized  the  essential  functions? 

Identified  required  staffing  and 
resources? 

Identified  necessary  mission-critical 
systems  and  data? 

0  10  20  30  40  50  60  70  80  90  100 

Percentage 

Yes 

Source:  GAO  analysis  ol  agency  COOP  plans. 

FIGURE  1  GAO  ANALYSIS  OF  AGENCY  COOP  PLANS 

Also  contributing  to  the  deficiencies  in  agency  COOP  plans  is  the  level  of  FEMA  oversight. 
In  1999,  FEMA  conducted  an  assessment  of  agency  compliance  with  FPC  65,  but  it  had  not 
conducted  oversight  that  was  sufficiently  regular  and  extensive  to  ensure  that  agencies 
corrected  the  deficiencies  identified.  Because  the  resulting  COOP  plans  do  not  include  all  the 
elements  of  a  viable  plan  as  defined  by  FPC  65,  agency  efforts  to  provide  services  during  an 
emergency  could  be  impaired. 33 

LEADERS  INVOLVEMENT 

Prior  to  Y2K  and  even  more  since  September  1 1 , 2001 ,  organizations  have  begun  paying 
more  attention  to  COOP  and  expanding  their  emergency  response  capabilities  to  include  the 
resumption  of  operations.34  Over  the  years,  it  is  important  to  note  that  most  organizations  did 
not  begin  planning  for  Continuity  of  Operations  until  their  leaders  felt  the  impact  of  an 
interruption.  In  many  cases,  they  were  not  even  moved  by  auditor  findings  or  best  practices 
recommendations.35  Legal  and  regulatory  requirements  generally  resulted  in  fundamental 
planning  simply  to  satisfy  the  requirements  to  get  through  the  audit.  However,  organizations  that 
have  experienced  interruptions  in  the  past  usually  have  workable  plan.36  The  demonstration  of 
potential  loss  due  to  interruption  caused  by  a  disaster  has  always  been  a  key  factor  in  moving 
leaders  and  their  organizations  towards  the  development  of  a  Continuity  of  Operations  plan. 


Partially  |  No 
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Ultimately,  COOP  planning  is  the  leader’s  responsibility,  all  the  way  up  the  chain  to  senior 
leaders.  This  is  not  only  the  result  of  mandates  by  the  governing  directives,  but  because  of  "duty 
of  trust"  and  "due  diligence"  required  of  junior  and  senior  leaders37.  This  will  prove  to  be  critical 
in  obtaining  executive  senior  level  support  for  COOP  exercising  and  funding.  Most  of  the  time 
organizations  with  the  best  plans  have  leaders  that  understand  their  needs  and  are  aware  of  the 
impact  if  a  disaster  occurs.  Organizations  with  leaders  that  are  forward  thinking  and  who  wish  to 
avoid  poor  performance  or  the  receipt  of  negative  publicity  due  to  a  disaster  will  usually  have  a 
strong  COOP  plan.38 

CHALLENGES 

Continuity  of  Operations  Planners  must  have  an  active  senior  leader  supporting  their 
efforts;  the  senior  leader  will  champion  the  effort  and  be  the  heavy  lifter  for  the  COOP  planners. 
Only  with  their  support  can  planners  expect  and  receive  the  required  participation  of  the  whole 
organization  to  make  all  the  plans  functional.  Planners  must  be  able  to  demonstrate  to  the 
senior  leaders  how  the  organization  will  benefit  from  the  planning  and  how  they  will  be 
successful  in  the  end.  Most  good  senior  leaders  are  optimists,  looking  beyond  obstacles  and 
focusing  on  opportunities  to  improve  the  organization.  There  is  little  appeal  for  them  in  looking 
at  a  small  likelihood  of  huge  disasters.  Keeping  leaders  focused  on  an  effort  that  will  address 
the  safety  of  the  organization’s  people,  soften  the  impact  on  services,  and  maintain  the  well¬ 
being  of  the  organization  are  much  more  powerful  motivators  for  senior  management.39  Having 
leader  support  will  most  likely  motivate  all  the  staff  members  to  actively  participate  in  the 
planning. 

A  COOP  plan  is  only  effective  if  it  has  command  and  control  over  all  of  the  people  and 
staff  sections  within  the  organization  it  serves.  Obtaining  cooperation  from  many  different 
functional  areas  within  an  organization,  especially  a  large  diversified  organization  like  the  DOD, 
is  a  challenge. 

Also,  many  organizations  that  have  just  begun  implementing  their  COOP  plan  will  be 
faced  with  extraordinary  integration  problems.  A  first-class  COOP  plan  will  replace  existing 
nonintegrated  Emergency  Response  Plans,  Data  Center  Recovery  Plans  and  Natural  Disaster 
Plans.  These  existing  plans  may  or  may  not  involve  formal  documentation  or  directives,  and 
organizations  may  face  resistance  from  staff  being  asked  to  allocate  time  from  day-to-day 
operations  to  put  an  official  plan  together.  Many  staff  members,  upon  being  told  to  write  their 
plans,  may  make  some  of  the  following  comments: 
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•  “Why  should  we  write  a  plan?” 

•  “We  know  what  to  do.” 

•  “An  attack  like  September  1 1  will  not  happen  again.  “ 

Planners  will  get  some  resistance  but  must  never  give  up  until  a  plan  is  developed  and  is 
exercised  in  accordance  with  DOD  directives. 

Another  challenge  is  keeping  the  COOP  plan  updated  as  staff  and  resources  change. 
Most  organizations  in  the  DOD  change  their  personnel  out  yearly,  if  not  sooner.  Information 
systems  and  other  technology  often  change  rapidly  as  well.  Therefore,  everything  in  a  plan 
needs  to  be  reviewed  and  modifications  submitted  to  the  planners  to  take  these  changes  into 
account. 

The  COOP  plan  is  a  living  document  and  must  to  be  updated  annually.  A  plan  that  is  a 
year  old  and  has  not  been  tested  is  probably  somewhat  obsolete,  as  numerous  personnel 
changes  may  have  taken  place,  as  well  as  the  organization's  recall  rosters.  Minimally,  the 
COOP  plan  should  be  thoroughly  reviewed  and  exercised  semi-annually  to  keep  up  with  the  flux 
of  changes  in  an  organization. 

BUDGET 

Developing  and  implementing  a  COOP  plan  will  cost  money,  as  will  updates  to  the  plan, 
exercises,  supplies,  maintenance,  and  the  hiring  of  contractor  support  at  various  stages  if 
needed.  The  organization  must  have  a  COOP  plan  that  is  current  in  order  to  help  defend  the 
budget  it  will  need  to  resource  and  run  a  successful  program.  This  means  that  the  COOP 
planners  need  to  have  an  understanding  of  the  DOD  budget  process.  Plans  for  site  upgrades, 
information  technology  replacement  and  facility  improvements  should  also  be  included  in  the 
process  of  obtaining  funds  to  initiate  the  COOP  efforts. 

In  comparison  to  the  overall  DOD  budget,  the  COOP  budget  is  a  small  percentage.  In  the 
early  phases  of  developing  a  plan,  the  funds  for  COOP  will  likely  be  reallocated  from  within  the 
organization’s  existing  budget,  or  from  specially  allocated  funds  set  aside  for  emergencies  by 
the  senior  leader  responsible  for  the  COOP  plan  development.40 

THE  CREATION  OF  A  PLAN 

Every  organization  should  set  their  COOP  planning  process  in  motion  by  conducting  a 
complete  and  comprehensive  Impact  Analysis  (IA).  An  IA  involves  identifying  the  critical 
functions  within  an  organization  and  determining  the  impact  if  these  functions  are  not 
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performed.  The  IA  is  a  very  important  document  because  it  identifies  the  potential  loss  of 
function  and  the  impact  it  will  have  on  the  organization.  The  IA  is  the  document  that  will  be 
presented  to  the  senior  leader  and  will  become  the  cornerstone  of  developing  the  COOP  plan. 

In  the  IA,  the  planners  must  include  a  look  at  the  risks  that  a  full  range  of  disasters  pose  to 
the  organization.  The  disasters  that  an  organization  should  be  prepared  for  include  but  are  not 
limited  to: 

•  Natural  (floods,  fire,  seismic  activity,  winds,  snow  and  ice,  volcanic  eruption,  tornado 
and  hurricane) 

•  Human  Threats  (robbery,  bombing,  embezzlement,  extortion,  terrorism,  chemical 
spill,  war  NBC  contamination,  airplane  crash  and  labor  strike) 

•  Technical  Disasters  (power  failure,  telecommunications  failure,  gas  leaks,  failure  of 
CPU  and  electromagnetic  pulse) 

Planners  should  keep  in  mind  other  problems  that  may  pose  no  threat  to  the  physical 
structure  of  the  facilities,  but  may  prohibit  the  staff  from  coming  to  work  (e.g.,  bad  weather,  road 
damages,  etc).  Most  organizations  in  DOD  have  essential  personnel  who  are  critical  to  their 
operations.  There  may  also  be  several  sensitive  functions  in  the  organization  that  must  be 
performed.  It  must  be  kept  in  mind  that  personnel  may  be  dependent  on  staff  in  other  sections 
to  accomplish  thier  sensitive  functions;  organizations  must  recognize  this  dependence  and 
integrate  that  process  into  the  plan.41 

The  critical  needs  of  each  staff  section  within  the  organization  must  be  evaluated 
carefully.  Mission  Essential  Functional,  Key  Personnel,  Information  Systems,  Service  Provider, 
and  Critical  Record  Keeping  should  be  included  in  the  Impact  Analysis  (IA).  Each  organization 
must  make  a  vigorous  effort  at  analyzing  their  day-to-day  functions.  A  good  IA  will  provide  a 
detailed  record  of  activities  on  the  organization  to  the  planners,  some  which  may  be  transparent 
to  the  senior  leader  and  the  employees  who  execute  them,  but  are  actually  critical  to  the 
success  of  the  organization  on  a  daily  basis.  An  analysis  over  a  specific  time  period  can  indicate 
the  principal  functions  performed  inside  and  outside  the  organization  to  determine  the  critical 
needs  questions  the  IA  should  address,  such  as  how  long  the  organization  could  function 
without  the  needed  equipment.  Other  questions  should  identify  the  high  priority  tasks  to  include 
and  how  often  the  tasks  must  be  performed.  The  analysis  will  also  address  equipment  and 
staffing  needed  to  perform  the  Mission  Essential  Functions,  and  what  it  will  take  to  replace  them 
in  a  disaster.  Planners  must  also  address  any  outsourced  functions  that  are  performed  by 
contractors.42 
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Prioritization  of  the  critical  Mission  Essential  Functions  is  also  important;  prioritization  will 
be  the  first  document  that  describes  the  order  in  which  functions  will  be  re-energized  after  a 
disaster  takes  place.  A  first-class  COOP  plan  would  include  a  very  detailed  prioritization  list  and 
since  the  planners  will  follow  this  list  while  building  the  COOP  plan,  it  will  be  crucial  to  its 
implementation. 

THE  IMPORTANCE  OF  PLANNING 

A  COOP  plan  could  be  the  most  important  document  to  ensure  that  the  organization  will 
survive  a  disaster.  Proper  planning  will  provide  the  guidance,  direction,  and  proper  actions  to 
survive  an  emergency  and  resume  operations.  A  plan  must  be  developed  for  individual  staff 
sections,  the  local  organization  and  national  level  disasters.  The  planners  must  consider  that  the 
primary  facility  may  be  non-functional  or  that  access  may  be  restricted  due  to  safety  concerns  or 
law  enforcement  investigations.  Planners  should  prepare  for  the  possibility  of  being  kept  out  of 
their  facility  for  at  least  30  days  or  more.  After  the  attack  of  September  1 1 , 2001  on  the 
Pentagon,  the  Army  G1  had  to  relocate  to  offices  at  Human  Resource  Command  in  the  local 
area  in  Crystal  City,  VA  near  the  Pentagon.  The  G1  moved  because  of  office  damage  and  law 
enforcement  investigation.  (G1  was  not  the  only  office  to  relocate:  G3  moved  to  the  Army 
Operations  Center.) 

The  primary  element  of  the  plan  is  the  development  of  an  Emergency  Operations  Center 
(EOC).  The  EOC  Chief  is  a  senior  leader,  and  is  supported  by  personnel  from  every  function  of 
the  organization.  The  EOC  Chief  must  be  empowered  with  the  necessary  authority  to  recover  or 
reconstitute  the  organization.  This  authority  will  include  not  only  the  ability  to  draw  upon  internal 
resources  at  a  moment's  notice,  but  also  the  authority  to  bind  the  organization  contractually  for 
required  services  from  vendors  and  suppliers.43 

The  subordinate  organizations  to  the  EOC  are  the  Capability  Assessment  Teams  (CATs). 
These  teams  are  responsible  for  determining  the  level  of  loss  for  the  organization  and  reporting 
accurate  information  to  the  EOC  so  that  options  may  be  identified.  CATs  will  be  comprised  of 
personnel  from  all  functional  areas  within  the  organization.  The  CATs  will  not  only  perform 
visual  inspections  of  the  work  area,  but  will  also  run  technical  tests  and  examination  of  Data 
Centers  and  Information  Systems  if  suitable.  The  CATs  are  the  eyes  and  ears  of  the  EOC 
Chief.44 

THE  WRITTEN  PLAN: 

With  leadership  involvement  the  written  plan  will  be  embraced  by  every  section  of  the 
organization.  Each  section  in  the  plan  will  include  actions  to  take  place  before,  during  and  after 
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a  disaster.  It  must  be  understood  that  the  end  users  of  the  plan  will  probably  never  read  or  use 
the  entire  document;  end  users  should  be  provided  with  a  short,  easily  executable  format  to 
ensure  rapid  understanding  and  immediate  execution.  The  plan  and  all  action  documents  must 
be  updated  regularly.  The  table  in  Figure  2  defines  several  excellent  topics  to  initiate  the 
development  of  a  COOP  plan.  In  addition,  the  planner  should  also  ensure  that  the  vendors  and 
service  providers  all  have  a  COOP  or  similar  plan,  and  construct  and  distribute  notification  lists 
and  telephone  alert  rosters  for  each  section.  The  planner  should  also  establish  a  timeline  for 


T*bl»  1 :  EigM  COOP  Pkmung  Topic*  DaKiwO  by  PPC  SS  I»nd  ExMnelo*  ol  Action* 

FPC  GG  planning  topic 

Example  of  action  ^element  of  viable  COOP  plan) 

Eft^rttiAl  functions  shotM  be  identified  to  provid*  it»*  basts  tor 
COOP  planmng. 

Ttv»  *g*r< y  aboild  pnortce  its  eseenhalturKUtone 

Plans  and  procedures  should  be  developed  and  documented  to 
provide  ter  continued  performance  of  ecoentioi  (unctions 

These  plans  should  include  a  roster  cf  personnel  who  can 
perform  toe  essential  functions. 

Otdaia  ol  auccwaaion  should  identify  alternates  to  Til  toy  potltione 
m  an  emergency. 

SiAXvuaion  Irate  shuuM  be  dc»*vlupvd  fc  t  the  erg*  u.y  head  and 

Ollier  key  yuspjrrv 

Detegiticns  c*  authority  should  idenlfy  the  legal  two  tor  eftoats 
to  matu*  riecii;ir.ne  in  omorgancies 

Delegations  should  include  the  circumstances  under  wtech  the 
a uti mhos  hagn  and  «id. 

Alternate  faciiQes  si  cud  be  aide  to  aMDport  operators  h  a 
threat-tree  environment  tor  up  to  30  days. 

Tlievs  tauim**  alioukl  prcn-kte  sufllclenl  space  and  eqtapnienl  to 
sustain  the  relocating  organization. 

Wprcp*n»Nfl  communications  should  proven  voice  and  data 
conrr*  in Icallo rra  with  other*  nekfe*  and  outekte  Ifie  organization 

The  aQsncy  cboild  bn  ahte  to  commumcnto  veith  ogoncy 
«kihI,  other  i*<»,  critical  cuetomera,  and  the  puhlto 

Vital  records  should  be  identified  and  made  readiy  abatable  in  on 
emergency. 

Electrcnic  and  paper  recorcfc  should  be  identified  and  protected 

Tesla  training,  and  ewarciaae  should  occur  regularly  to 
deincnaliate  ai  d  iiipicne  ugevicaes'  COOP  oapabiltRUS. 

InrividuAl  and  team  trailing  ah  odd  t*  conducted  anmaly 

Sara*.  fVC  61  FEN* 


determining  relocation  site  activation.  In  addition,  planners  need  to  include  Legal  and  Public 
Affairs  personnel  in  the  COOP  plan.45 


FIGURE  2  INSTRUCTIONS  FOR  PLAN  DEVELOPMENT46 

PERSONNEL  IMPACT: 

During  a  major  continuity  plan  implementation,  the  staff  will  be  under  significant  stress  and 
may  panic  or  be  more  concerned  about  their  families;  many  may  be  unwilling  or  unable  to  come 
to  work.  It  may  be  necessary  to  hire  additional  staff  or  acquire  temporary  services,  which  may 
bring  in  security  vulnerabilities.47  Organizations  should  be  prepared  not  only  to  help  themselves, 
but  also  to  help  their  employees  resume  their  normal  lives  and  work  routines  as  quickly  as 
possible.  The  faster  the  employees  are  able  to  return  to  a  standard  of  normalcy,  the  more 
quickly  the  organization  will  be  able  to  recover  and  resume  operations. 
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TRAINING 

Organizations  must  train  the  way  they  will  execute  during  a  disaster.  If  a  plan  is  developed 
and  not  exercised,  the  organization  may  fail  or  perform  poorly  during  a  disaster.  The  plan  should 
be  exercised  annually  and  semi-annually.  A  planner  should  prepare  and  conduct  tabletop 
exercises  with  senior  leader  involvement,  as  well  as  telephonic  alerts  and  sign-in  roster  alerts 
for  physical  accountability  of  personnel.  The  exercises  will  allow  the  leadership  to  identify 
weaknesses  and  enable  the  EOC  Chief  to  begin  to  understand  his  or  her  role  in  leading  the 
exercise  more  clearly  and  effectively.  Each  exercise  should  use  a  different  scenario  and  must 
be  conducted  under  conditions  that  are  as  realistic  as  possible. 

VITAL  RECORDS,  DOCUMENTS  AND  DATA  STORAGE 

Many  organizations  rely  on  vital  records  and  various  documents  and  papers  to  conduct 
daily  operations.  These  records  are  important  because  of  historical,  operational  or  legal  needs. 
Records  can  be  maintained  on  paper,  microfiche,  microfilm,  magnetic  media,  or  optical  disk. 
Whatever  means  are  used  to  store  the  information  it  should  be  backed  up  at  regular  intervals 
and  stored  at  an  alternate  location.  The  interval  at  which  data  is  backed  up  is  at  the  discretion  of 
the  organization;  some  back  up  data  daily  or  once  a  week.  Storing  data  off  site  is  an  excellent 
way  to  conduct  operations  and  to  prevent  your  back-up  data  from  being  compromised  in  the 
event  of  a  disaster  at  your  primary  site.48 

Storage  Area  Network  is  becoming  a  popular  way  of  storing  large  amounts  of  data  off  site. 
It  is  a  process  by  which  data  is  transmitted  from  a  facility  to  a  back-up  site  electronically.  The 
advantage  is  that  there  is  no  longer  a  transportation  threat  to  the  data,  and  the  data  is  sent  off 
site  immediately.  The  network  can  then  store  the  data  on  tape  and  remove  it  to  off-line  until  the 
organization  calls  for  it.  Storage  Area  Network  is  more  expensive  than  traditional  data  storage, 
primarily  due  to  transmission  charges. 

FINDING  THE  RIGHT  FACILITY 

A  plan  must  be  developed  for  resuming  operations  if  the  data  and  processing  center  has 
sensitive  functions  (as  most  DOD  organizations  do).  Several  options  exist  to  help  recover  from  a 
disaster  or  emergency.  Moving  to  a  hot  site  (which  will  be  described  in  greater  detail  later)  is  a 
preferred  option.  Some  organizations  have  developed  and  built  their  own  internal  hot  site,  which 
is  a  redundant  facility,  ready  for  operation  with  little  notice.  These  sites  are  updated  with  the 
most  current  information  technology  available.  Maintaining  a  hot  site  is  very  expensive  and 
many  organizations  will  seek  other  options  for  data  and  processing  recovery. 49 
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For  less  serious  disasters,  processing  capabilities  can  be  restored  from  back-ups  or 
original  media,  by  repairing  equipment  components,  or  by  purchasing  new  equipment  using  the 
purchase  order  option.  Federal  agencies  have  the  authority  to  issue  purchase  orders  to  quickly 
buy  equipment  and  supplies  in  limited  quantities  during  an  emergency.  This  authority  is  usually 
limited  to  $25,000  to  $50,000,  and  is  sufficient  in  the  aftermath  of  an  emergency  or  disaster  for 
buying  off-the-shelf  equipment.  There  are  two  ways  that  essential  hardware  can  be  replaced: 
through  the  outright  purchase  of  replacement  or  upgraded  equipment,  or  by  leasing  essential 
equipment  for  a  limited  period  of  time. 

The  outright  purchase  of  replacement  equipment  is  the  clearest  use  of  the  purchase 
order.  Flowever,  the  purchase  of  upgraded  equipment  is  a  reasonable  alternative  if  it  is  not  cost- 
effective  to  salvage  the  present  equipment.  A  short-term  lease  of  essential  equipment  to 
augment  or  replace  existing  equipment  during  COOP  operations  can  be  another  cost-effective 
alternative,  however,  the  risk  involved  with  leasing  must  be  addressed;  all  systems  used  before 
and  after  a  COOP  operation  must  be  thoroughly  reviewed  to  ensure  that  information  stored  or 
processed  on  the  hardware  is  protected.50 

Planners  should  also  consider  an  in-house  backup  strategy  that  employs  under-utilized 
facilities  and  old  or  new  equipment  on  hand  awaiting  installation.  In-house  back-up  maximizes 
the  use  of  space  and  equipment,  which  is  capable  of  being  upgraded  in  a  very  short  period  of 
time  to  support  continuity  of  operations.  The  in-house  equipment  that  is  to  be  used  as  back-up 
needs  to  be  included  in  the  plan  because  it  may  not  be  available  at  the  time  of  the  disaster.51 
Considerable  thought  and  analysis  must  go  into  a  site  selection.  A  planner  should  look  for  sites 
that  are  flexible  and  provide  the  organization  with  the  ability  to  carry  out  its  essential  functions 
with  minimal  stress.  The  most  important  selection  criteria  are  site  protection  and  the  people 
who  are  involved;  a  site  should  not  be  selected  based  on  convenience.  There  are  several 
recognized  strategies  for  configuring  sites  in  the  event  of  disasters: 

•  Plot  Site 

•  Cold  Site 

•  Redundant  Site 

•  Reciprocal  Agreement 

•  Hybrid  Site 

Following  is  a  description  of  each  configuration. 
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HOT  SITE 

A  hot  site  is  a  building  already  equipped  with  the  capabilities  to  relocate  and  conduct 
operations.  Operational  standby  facilities  such  as  a  hot  site  require  payment  of  some  kind  for 
space,  specific  hardware,  software  and  communications  equipment  that  may  require  updating 
whenever  changes  occur.  A  potential  drawback  for  information  technology  users  is  that 
services  are  always  changing  and  may  not  be  widely  dispersed.  A  hot  site  facility  may  not  be 
conveniently  located  and  may  be  some  50  miles  or  more  away  from  the  organization.52 

COLD  SITE 

A  cold  site  is  a  building  for  housing  processors  that  can  be  easily  put  in  use.  The  facility 
may  be  owned  by  the  organization  and  function  as  an  administration  site,  or  owned  by  another 
agency  and  leased  for  use  by  several  departments  within  the  organization.  Cold  sites  are  more 
practical  for  command  and  control  type  operations  because  most  facilities  are  owned  by  the 
organization  or  agency.  The  facility  can  be  any  office  space  with  sufficient  electrical  power, 
communications  lines  (already  installed  or  capable  of  being  installed  during  or  soon  after  a 
disaster),  and  air  conditioning.53 

A  cold  site  may  also  be  supported  by  a  contract  if  the  equipment  is  not  already  on  hand. 
There  are  a  number  of  hardware  vendors  who  offer  guaranteed  delivery  and  set-up  within  24 
hours.  Although  the  maintenance  costs  are  somewhat  less  than  an  operational  standby,  they 
still  represent  a  continuing  expense.  For  information  technology  activities,  consideration  should 
be  given  to  leasing  essential  equipment.  Leasing  eliminates  the  ongoing  maintenance  costs  of  a 
special  equipment  contract,  but  it  does  not  provide  for  the  guarantees  that  appropriate 
equipment  will  be  available  when  needed.  As  discussed  earlier,  leasing  also  creates  the 
problem  of  data  security,  as  special  protection  must  be  taken  to  ensure  that  all  data  that  has 
been  stored  or  processed  on  the  system  has  been  removed  from  the  leased.54 

REDUNDANT  SITE 

A  redundant  site  is  a  facility  that  is  set  up,  equipped  and  configured  exactly  like  the 
primary  site.  All  configuration  of  equipment  will  reflect  the  primary  site.  It  could  mean  that  the 
user  at  the  redundant  site  logs  in  to  his  or  her  equipment  the  same  way  they  did  at  the  primary 
site.55 

RECIPROCAL  AGREEMENT 

A  reciprocal  agreement  is  a  formal  agreement  between  two  organizations.  The  agreement 
is  typically  with  an  external  agency  to  provide  backup  support  in  the  event  of  a  disruption  at  one 
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of  the  organization’s  primary  sites.  Although  low  maintenance  and  other  associated  costs  are 
some  advantages  to  this  alternative,  consideration  must  be  given  to  establishing  an  agreement 
with  an  organization  that  is  not  located  in  the  same  area,  and  thus  has  the  same  chance  of 
being  affected  by  the  same  disaster;  the  organizations  must  be  geographically  separate  in  order 
to  provide  effective  continuity  of  operations  capability.  Agreements  can  be  reached  between 
superior  and  subordinate  levels  or  between  equivalent  levels,  as  long  as  the  geographical 
separation  of  sites  is  achieved.  The  biggest  disadvantage  of  a  reciprocal  agreement  is  that  the 
two  organizations  may  have  divergent  expectations  regarding  the  level  of  support  that  will  be 
given  in  the  event  of  a  disaster.  Reciprocal  agreements  are  not  considered  workable  solutions 
without  a  formal  document  outlining  all  conditions  and  signed  by  individuals  in  positions  of 
authority  to  uphold  the  agreement.56 

HYBRIDS 

A  hybrid  site  is  a  combination  of  a  hot  site,  redundant  site  and/or  reciprocal  agreement. 
Your  organization  can  have  a  hot  site  as  a  back-up  in  case  a  redundant  or  reciprocal  agreement 
site  is  damaged  by  a  separate  disaster.57 

In  addition  to  the  alternatives  listed  above,  there  are  two  other  approaches  available  to 
leaders  in  selecting  a  site.  One  option  is  to  allow  employees  to  telecommute  and  work  from 
home;  even  partial  use  of  this  option  would  ease  the  continuity  of  operations  load  by  reducing  or 
eliminating  the  need  for  office  space,  hardware,  software  and  furniture.  This  option  also  offers 
immediate  availability  and  reduced  cost,  and  can  be  tested  whenever  leaders  feel  the  need. 

The  disadvantage  is  that  many  employees  don’t  have  the  hardware,  software,  connectivity, 
information  security  and  anti-viral  protection  at  home  to  telecommute.58  The  second  option  is 
for  organizations  to  identify  and  designate  a  subordinate  organization  as  the  successor  in  the 
event  all  communications  are  lost  with  your  organization  during  a  major  disaster.  The 
designated  organization  should  be  large  enough  and  capable  of  continuing  to  carry  out  the 
essential  functions  until  contact  has  been  reestablished  or  reconstitution  of  the  primary 
organization  has  occurred.  Whatever  option  is  used,  consideration  should  be  given  to  ensuring 
that  the  locations  are  geographically  separate  areas  of  the  United  States. 

CONCLUSION 

The  Attack  on  September  1 1 , 2001  occurred  three  years  ago  and  many  organizations  are 
still  not  prepared  to  conduct  COOP  operations.  GAO  released  a  report  in  September  2004  of  34 
organizations,  all  but  three  of  the  agencies  reviewed  had  developed  and  documented  some  of 
the  elements  of  a  viable  COOP  plan;  none  of  the  agencies  could  demonstrate  that  they  were 
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following  all  the  guidelines  in  FPC  65.  There  was  a  wide  variation  in  the  number  of  organizations 
that  addressed  various  elements  identified  in  the  guidelines.  Leaders  and  members  of 
organizations  must  understand  that  COOP  planning  is  a  good  business  practice  for  all 
organizations.  The  objective  is  simply  to  ensure  that  the  capability  exists  to  continue  essential 
functions  of  an  organization  across  a  wide  range  of  potential  emergencies.  Organizations  are 
dependent  on  people,  communications  and  a  command  and  control  infrastructure  to  conduct 
daily  operations,  and  will  be  adversely  impacted  by  disruptions.  COOP  planners  must  have  the 
commitment  from  the  leaders  of  the  organizations  to  be  successful  and  have  “buy-in”  from  all 
sections  within  the  organization.  Plans  should  be  developed  that  maintain  the  highest  level  of 
readiness,  are  capable  of  implementation  with  or  without  warning,  and  can  be  sustained  for  up 
to  30  days  after  activation. 

A  first-class  COOP  plan  is  essential  in  the  defense  of  the  COOP  budget,  and  COOP 
planners  must  have  an  understanding  of  the  DOD  budget  process  to  be  able  to  obtain  sufficient 
funds  to  support  their  efforts.  Developing  and  implementing  a  COOP  plan  will  cost  money,  as 
will  updates  to  the  plan,  exercises,  supplies,  maintenance  and  the  hiring  of  contractor  support  at 
various  stages  if  necessary.  At  a  minimum,  the  COOP  plan  should  be  thoroughly  reviewed  and 
exercised  semi-annually  to  keep  up  with  the  flux  of  changes  in  an  organization. 
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